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addition to the embedded electronic watermark information. 
Let Bk, Dk, {Mkl, Mk2, . . . , Mki, . . . , Mkn}, and {Mkl', 
Mk2', , . , , Mkj', . . . , Mkm'} be the encryption key (to be 
referred to as a shared encryption key) shared between the 
encryption and decryption systems, the encryption key (disk 
key) for encrypting the audio data sequence, the bunch of □ 
encryption keys (master keys) for encrypting the disk key, 
and the bunch of part master keys registered in the decryp- 
tion system, respectively^ 

Note that the part master key is a key corresponding to m 
keys of the n master keys. Each part master key is data 
prepared so as to obtain a master key by performing a certain 
computation between the data extracted from WM(ADi). 

Ej^^tik) represents a disk key generated by encryption 
using the disk key itself. {Ej^^^JDl^) (i-1. . . , n)} represents 
disk keys generated by encryption using the n master keys. 
WM(Ar)T) represents. au gio data ADi generated by embedr 
ding data of some of the master keys by using an electronic 
waterm ark technique. Eni/ADi) represents audio data gen- 
erated by encryption using the disk key Dk. E^iJ[Ej^jJ[Uk)) 
represents the disk key itself encrypted using the disk key 
generated by encryption using the shared encryption key Bk. 
^Bki^MfJP^) represents the disk key encrypted by using a 
bunch of master keys generated by encryption using the 
shared encryption key Bk. E^fJ(E^jlADi)) represents audio 
data encrypted Tising the disk key generated by encryption 
using the shared encryption key Bk. 

Ep;XDk)„Kener_ated by encrypting the disk key by , itself 
and I E;vf;hffik) } generated by encr y pting the disk key using 
the bunch of master ke ys are recorded in a key recording 
area (lead-in area) of the inner peripheral portion of the 
DVD 1. WM(ADi) obtained by embedding some of the 
master keys as an electronic waterm ark in the audio data 
sequence AD={AD1,AD2, . . . ,ADi, . . . } and E^jfc(ADi) 
generated by encryption using the disk key are recorded in 
a data recording area (data area) of the DVD 1. 

The operation of this embodiment will be described with 
reference to a flow chart in FIG. 2. 

In step SU, the encryption key Bk used in communication 
between the encryption and decryption systems A and C is 
shared using an existing encryption key sharing protocol 3, 

In step S12, the disk key E^jt(Dk) encrypted using the disk 
key Dk itself and the disk key {Ej^ki(Dk)} encrypted using 
the bunch of master keys, which are recorded on the DVD 
1 by a DVD drive unit (not shown) are read. The encryption 
unit 4 encrypts the read keys using the shared encryption key 
Bk to obtain E^^(E^^(Dk)) and {E^^(E^;,XDk))}* These 
codes are sent to the decryption system C via the CPU 
interface or bus B. Note that the data read from the DVD 1 
are decoded and error-corrected by the demodulation/error 
correction unit 2 before the data are input to the encryption 
unit 4. 

In step S13, the decryption unit 5 in the decryption system 
C decrypts, using the shared encryption key Bk, the keys 
E^jt(EoJt(Dk)) and {E^^tCEA/^/Dk))} received through the 
CPU interface B to obtain E^^CDk) and {Ej^JDk)}. 

In step S14, the encryption system A reads the audio data 
WM(ADi) in which information of some of the master keys 
Mki is embedded as an electronic watermark. The encryp- 
tion unit 9 encrypts it using the shared encryption key Bk to 
obtain Ej3jt(WM(ADi)). This data is sent to the decryption 
system C through the CPU interface B. Note that the data 
read from the DVD 1 are demodulated and error-corrected 
by the demodulation/enor correction unit 7 before the data 
are input to the encryption unit 9. 

In step S15, the decryption unit 10 in the decryption 
system C decrypts, using the shared encryption key Bk, the 
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key E^jt(WM(ADi)) received through the CPU interface B to 
extract WM(ADi). The electronic watermark extraction unit 
11 extracts information WM as some of the master keys Mki 
embedded in the data ADi. WM(ADi) is sent to the MPEG- 

5 Decoder 14 through the control switch 13 upon extraction of 
the information WM. 

In step S16, the master key decryption/determination unit 
6 extracts the disk key Dk using the disk key E^ffDk) 
encrypted using the disk key Dk itself and the disk key 

10 {EAflb(Dk)} encrypted using the bunch of master keys, 
which are obtained in step S13, the information WM as some 
of the master keys obtained in step S15, and the bunch of 
part master keys registered in the decryption system in 
advance. 

15 The operation of the master key decryption/determination 
unit 6 will be described below with reference to FIG. 3. 

The part master key Mkj'^is extracted from a memory (JO) 
in which a given bunch of part master keys {Mkj'} in the 
decryption system C is storedXThe master key decryption/ 

20 determination unit 6 performs computation (Jl) for gener- 
ating a predetermined master key using the information WM 
as some of the master keys, thereby obtaining a master key 
candidate Mkj. 
A decryption unit J2 decrypts, using the master key 

25 candidate Mkj, the disk key E^JDk) encrypted using the 
bunch of master keys {Mki} to obtain a disk key candidate 
Dk'. A decryption unit J3 decrypts, using the disk key 
candidate Dk', the key Ej-^JJ)k) obtained by encrypting the 
disk key using itself to obtain a disk key candidate Dk". 

30 A comparator J4 compares the disk key candidate Dk" 
with the disk key candidate Dk'. If they coincide with each 
other, the disk key candidate Dk' is output from the master 
key decryption/determination unit 6 as the correct disk key 
Dk; otherwise, the above operation is repeated until a correct 

35 disk key Dk is obtained. 

In step S17, the audio data E^fj(ADi) encrypted by the 
disk key Dk and recorded on the DVD 1 by a DVD drive unit 
(not shown) is read and sent to the decryption system C via 
the CPU interface B. The data read from the DVD 1 are 

40 demodulated and error-corrected by the demodulation/error 
correction unit 7 before the data are sent to the CPU 
interface B. 

In step S18, the decryption unit 12 in the decryption 
system C decodes, using the disk key Dk, Ej^flADi) received 
45 via CPU interface B to obtain compressed audio data ADi as 
a plaintext. 

It is determined in step SI 9 whether the decryption 
process continues. If YES in step S19, the operations in steps 
S17 and S18 arc repeated. 

50 When the resultant audio data ADi is compressed by the 
data compression standard called, e.g., MPEG- Audio, it is 
decoded (expanded) by the MPEG-Decoder 14. The 
decoded data is converted into an analog signal by the D/A 
converter 15. The analog signal is sent to an audio 

55 amplification/output unit such as a loudspeaker amplifier 
(not shown) and reproduced. 
The execution order of steps S12 and S14 is reversible. 
The audio data in which the information of some of the 
master keys is embedded as the electronic watermark infor- 

60 mation has a length enough to embed the key information of 
some of the master keys. If the audio data does not have a 
sufficient length, the electronic watermark information is 
embedded in a plurality of audio data. 
The audio data ADi need not be transferred from the 

65 decryption unit 12 to the MPEG-Decoder 14 one by one, but 
may be transferred in units of a predetermined number of 
audio data. 
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According to the copy protection apparatus of this before compression. In this case, the electronic watermark 

embodiment, electronic watermark information must be embedding unit 25 can be omitted, 

used to decrypt a disk key, and unauthorized business <Second Embodimcnt> 

operations ofselling copied media can be prevented, thereby A copy protection apparatus according to the second 

preventing copyright infringement. s embodiment of the present invention will be described 

According to the copy protection apparatus of this below, 

embodiment, encryption and decryption units can be FIG. 5 is a view showing the copy protection apparatus of 

designed independently of the core of the reproduction the second embodinient of Oie present invention. Tte same 

portion of the digital recording/reproduction equipment, T""? fVj f ^^'^ denote the same parts m 

such as the DVD 1, as can be apparent from FIG. 1. Even lo ^^^^.f ' ^ ^l^!^lfJ"^''''^T 7Tu 

, I.- , -.L J 1 * • * 1 The copy protecuon apparatus of this embodiment is 

If a cryptographic algonthm and electronic watermark are ^ connected to a so-called CPU bus of a playback CPU 

broken, only the decrypUon system C (or both the encryption ^^^^^^^ ^ computer such as a personal computer (to be 

and decryption systems A and C) is replaced with another j^fe^^^j to as a PC hereinafter), and encrypted data flows on 

the CPU bus. Note that only part associated with the 

According to the copy protection apparatus of the present 15 playback CPU is illustrated in FIG, 5. 

invention, even if data flowing on the CPU bus B is stored, ^ encryption system A is connected to a decryption 

it cannot be reproduced or used since the data flowing on the system C via a CPU bus B. Data from the decryption system 

CPU bus is encrypted and in which water mark information C is output via, e.g., an I/O port except the CPU bus B. More 

is embedded. specifically, in this embodiment, data is input/output without 

Master key information registered on the decryption sys- 20 being through the CPU bus B, but data is transferred 

tem C side does not serve as perfect key information. Every between the systems A and C using the CPU bus B. 

time the DVD 1 is played back, key information contained The encryption system A comprises demodulation/error 

in the contents must be used to obtain perfect key informa- correction units 2 and 7, and an encryption unit 4. The 

tion. Even if master key information registered in the encryption system A is formed as one independent IC chip, 

decryption system is peifectly revealed and misuse is tried 25 The decryption system C comprises decryption units 5 

using the revealed master key information, the DVD 1 and 34, a master key decryption/determination unit 31, an 

cannot be normally played back. electronic watermark extraction unit 35, a control switch 33, 

Finafly, a method of recording audio data and key infor- and a key generation unit 32. 

ation on the DVD 1 according to this embodiment will be The control switch 33 receives a control signal (CS) for 

described with reference to FIG. 4. . - 30 inputting a disk key Dk as an input signal when the first 

In the system of this embodiment, when input audio data processing data sequence is input. Otherwise, the switch 33 

is analog data (A-Audio), an A/D converter 21 converts it receives a control signal (CS) for inputting a signal from the 

into digital data (D-Audio). Copy control information (CCI ) key generation unit 32 as an input signal, 

data and the like are embedded in the converted digital data In this embodiment, the decryption system C also 

in an electronic watermark embedding unit 22, as needed. 35 includes an MPEG-Decoder 14 and a D/A converter 15 for 

Note that the electronic watermark embedding unit 22 can converting the encoded digital audio data into analog audio 

be omitted depending on the system arrangement. An data. 

MPEG-Audio encoder 23 compresses the data. The two decryption units 5 and 34 are illustrated in the 

The output audio data ADi from the MPEG-Audio decryption system C in FIG. 5. However, one decryption 

encoder 23 is output to an electronic watermark embedding 40 unit can constitute these two decryption units in practice, 

unit 25 by a switch 24 when the information WM as some The decryption system C is formed as one independent IC 

of the master keys is to be embedded. chip. 

When the data is input, the electronic watermark embed- Some of master keys to be described later are registered 

ding unit 25 e mbeds the info rmatiop as soroe_of,the,niaster^ (stored) in the decryption system. The master keys are 

keys as an electronic_waJtenDark,inJhe^audio^Ma^ 45 recorded in a secret area in the chip so as not to allow a user 

outputs.data-WM(ADi). to externally obtain them or intentionally read out them from 

The electronic watermark embedding unit 25 receives the the chip of the decryption system C. 

audio data ADi in which all pieces of information WM The number of types of keys Ejv/fa(Dk) obtained by 

serving as some of the prepared master keys are embedded. encrypting the disk key using master keys Mki recorded on 

The audio data WM(ADi) in which the information WM 50 a DVD 1 and the number of types of part master keys Mki 

serving as some of the master keys are directly recorded on in the decryption system C can be set in the same manner as 

a DVD 27. in the first embodiment. 

The audio data ADi in which the information WM serving The encryption and decryption keys (both are Bk because 

as some of the master keys need not be embedded is output the shared encryption key is used) used in cryptographic 

to an encryption unit 26 by a switch 24. The encryption unit 55 communication via the CPU bus B are shared by the 

26 encrypts the disk key Dk using the input audio data ADi. encryption and decryption systems A and C. 

The encrypted audio data Dk(ADi) is recorded on the DVD A controller (not shown) controls the overall operation. 

27. For example, the controller can be realized by causing the 

A key {Ej^Jfik)} obtained by encrypting the disk key Dk CPU of the computer to execute a program. Examples of 

using the bunch of master keys used in encrypting the audio 60 control of this controller are designation associated with a 

data ADi and a key Dk(Dk) encrypted by the disk key itself data read from the DVD 1, designation of data transfer 

arc also recorded on the DVD 27. destination, designation associated with data output from the 

In FIG. 4, the information serving as some of the master decryption system, and the like, 

keys is embedded as an electronic watermark in the audio The controller is triggered by a user through a user 

data ADi compressed by the MPEG- Audio encoder 23. 65 interface or by a process in a given application program. 

However, the electronic watermark embedding unit~25 may In this embodiment, a digital source audio data sequence, 

embed the electronic watermark in the digital audio data an audio data sequence (compressed data sequence), and 
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audio data in which data of some of the master keys is 
embedded as an electronic watermark are represented by 
D-Audio, AD={AD1, AD2, . . . , ADi, . , , }, and WM(ADi), 
respectively. 

Depending on audio data sequences AD, copy control 5 
electronic watermark information may be embedded in 
addition to the embedded electronic watermark information. . 
Let Bk, Dk, {Mkl, Mk2, . . . , Mki, . . . , Mkn}, and {Mkl', 
Mk2', . . . , Mkj*, , . . , Mkm'} be the encryption key (to be 
referred to as a shared encryption key) shared between the 
encryption and decryption systems, the encryption key (disk 
key) for encrypting the audio data sequence, the bunch of n 
encryption keys (master keys) for encrypting the disk key, 
and the bunch of part master keys registered in the decryp- 
tion system, respectively. 

In FIG. 5, Ej5jj.(Dk) represents a disk key generated by 
encryption using the disk key itself. [Ej^^JipiC) (i=0, 1, . . . , 
D-1)} represents disk keys generated by encryption using 
the n master keys. WM(ADi) represents audio data ADi 
generated by embedding information necessary for gener- 
ating encryption keys for subsequent audio data using an 20 
electronic watermark technique. E^;^^jv/ADi) represents 
audio data generated by encryption using the disk key Dk 
and the information WM sent to the decryption system by 
the electronic watermark in advance. E^t(Ex)jfc(Dk)) repre- 
sents the disk key itself encrypted using the disk key 25 
generated by encryption using the shared encryption key Bk. 
E^fj(Ej)fJ(ADi)) represents disk keys encrypted using the 
bunch of master keys encrypted using the shared encryption 
key Bk. 

E^jt(Dk) generated by encrypting the disk key by itself 30 
and {Ej^fjpk)} generated by encrypting the disk key using 
the bunch of master keys are recorded in a key recording 
area (lead-in area) of the inner peripheral portion of the 
DVD 1. E^jt(WM(ADi)) in which part of the information for 
generating the decryption key of the subsequent audio data 35 
in the audio data sequence AD ={ ADI, ADZ, . . . , ADi, . . . } 
is embedded as an electronic watermark and E^ij^^^^^ADi) 
generated by encryption using a data key (i.e., a key gen- 
erated by the disk key and the information WM sent to the 
decryption system as the electronic watermark) are recorded 40 
in a data recording area (data area) of the DVD 1. 

The operation of this embodiment will be described with 
reference to a flow chart in FIG. 6. 

In step S21, the encryption key Bk used in communication 
between the encryption and decryption systems A and C is 45 
shared using an existing key sharing protocol. 

In step S22, the disk key E^jt(Dk) encrypted using the disk 
key Dk itself and the disk key {Ej^f^(pk)} encrypted using 
the bunch of master keys, which are recorded on the DVD 
1 by a DVD drive unit (not shown) are read. The encryption 50 
unit 4 encrypts the read keys using the shared encryption key 
Bk to obtain E^,(Ej,^k)) and {£^^^,{0^))}- l^^ese 
codes are sent to the decryption system C via the CPU 
interface B. 

Note that the data read from the DVD 1 are demodulated 55 
and error-corrected by the demodulation/error correction 
unit 2 before the data are input to the encryption unit 4. 

In step S23, the decryption unit 5 in the decryption system 
C decodes, using the shared encryption key Bk, the keys 
E5jfc(Ez>jt(Dk)) and Ej;t(Ej^JDk)) received through the CPU 60 
interface B to obtain Ej-^fJ^Dl^) and E^,{Dk). 

In step S24, the master key decryption/determination unit 
31 extracts the disk key Dk using the disk key Ej;^fJ(pk) 
encrypted using the disk key Dk itself, the disk key {Ej^j^ 
(Dk)} encrypted using the bunch of master keys Mki, and 65 
the bunch of master keys Mkj registered in the decryption 
system in advance. 
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The operation of the master key decryption/determination 
unit 31 will be described below. 

The master key Mkj is extracted from a memory which 
has registered the bunch of master keys {Mkj} in the 
decryption system. The disk key Ej^^f^j^Dk) encrypted using 
the bunch of master keys {Mki} is decrypted using a master 
key candidate Mkj to obtain a disk key candidate Dk*. 

E£,jt(Dk) obtained by encrypting the disk key by itself is 
decrypted using the disk key candidate Dk' to obtain a disk 
key candidate Dk". 

The disk key candidate Dk" is compared with the disk key 
candidate Dk'. If they coincide with each other, the disk key 
candidate Dk' is determined as a correct disk key and output 
from the master key decryption/determination unit 31. If 
they do not coincide with each other, the above operation is 
repeated until a correct disk key is obtained. 

In step S25, the encryption system A reads the audio data 
Ez3A(WM(ADi)) which is recorded on the DVD 1 by a DVD 
drive unit (not shown) and encrypted by the disk key Dk and 
in which information necessary for generating the decryp- 
tion key of the subsequent audio is embedded. The read 
audio data is sent to the decryption system C via the CPU 
interface B. Note that the data read from the DVD 1 are 
demodulated and error-corrected by the demodulation/error 
correction unit 7 before the data are input to the encryption 
system A. 

In step S26, using the disk key Dk, the decryption unit 34 
in the decryption system C decrypts the data E^jt(WM(ADi)) 
received via the CPU interface B to extract the key 
WM(ADi). The electronic watermark extraction unit 35 then 
extracts the information WM necessary for generating the 
decryption key of the subsequent audio data, which is 
embedded in the data ADi. After the information WM is 
extracted, WM(ADi) is directly supplied to the MPEG- 
Decoder. The key generation unit 32 generates audio data 
decryption key Dk+WM using the disk key Dk and the key 
generation information WM. 

In this case, the decryption key (this key is the same as the 
encryption key in use of the common key encryption) 
corresponding to the encryption key used to record audio 
data on the DVD 1. The following various relationships can 
be set between the disk key used in encryption/decryption 
the first audio data, the key generation information WM, and 
the key used in encryption/decryption the subsequent audio 
data. The subsequent audio data (encryption/decryption) key 
is expressed as Dk+WM in the following description. 
(Relationship 1) 

Exclusive OR data adjusted to have the same data length 
as that of the disk key by the disk key Dk and the key 
generation information WM is defined as the encryption key 
of the subsequent audio data. 
(Relationship 2) 

The disk key Dk encrypted using the key generation 
information WM as the encryption key is defined as the 
encryption key of the subsequent audio data. 

In step S27, the DVD drive unit (not shown) reads audio 
data E£>jt4.Twv#(ADi) recorded on the DVD 1 and encrypted 
using the audio data key Dk+WM and sends it to the 
decryption system C via the CPU interface B. The data read 
from the DVD 1 are demodulated and error-corrected by the 
demodulation/error correction unit 7 before they are sent via 
the CPU interface B. 

In step S28, using the audio data key Dk+WM, the 
decryption unit 34 in the decryption system C decrypts the 
data Ej^^^wj^ADi) received through the CPU interface B, 
thereby obtaining the compressed audio data ADi serving as 
a plaintext. 
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In step S29, it is determined whether decryption contin- 
ues. If YES in step S29, the operations in steps S27 and S28 
are repeated. 

As described above, when the resultant data ADi is 
conapressed complying with the data compression standard 5 
called, e.g., MPEG- Audio, the data is decoded (expanded) 
by the MPEG-Decoder 14 and converted into an analog 
signal by the D/A converter 15. The analog signal is sent to 
an audio amplification/output unit such as a speaker ampli- 
fier (not shown) and then reproduced. lo 

The data in which the key generation information of the 
audio data key is embedded as the electronic watermark 
information has a length enough to embed the key genera- 
tion information of the audio data key. If the audio data does 
not have a sufficient length, the electronic watermark infor- 15 
mation is embedded in a plurality of audio data. 

The audio data ADi need not be transferred from the 
decryption unit 34 to the MPEG-Decoder 14 one by one, but 
may be transferred in units of a predetermined number of 
audio data. 20 

According to the copy protection apparatus of this 
embodiment, electronic watermark information is embedded 
in the multimedia data and used to decrypt the multimedia 
data, and unauthorized business operation of selling copied 
media can be prevented, thereby preventing infringement of is 
copyrights. 

According to the copy protection apparatus of this 
embodiment, as in the first embodiment, encryption and 
decryption units can be designed independently of the core 
of the reproduction portion of the digital recording/ 30 
reproduction equipment, such as the DVD, as can be appar- 
ent from FIG. 5. Even if a cryptographic algorithm and 
electronic watermark are broken, only the decryption system 
C (or both the encryption and decryption systems A and C) 
is replaced with another one. 35 

Finally, a method of recording the audio data and key 
information on a DVD 1 according to this embodiment will 
be described with reference to FIG. 7. 

In this system, when input audio data is analog data 
A- Audio, it is converted into digital audio data D -Audio by 40 
an an alog-to -digital converter, and the digital audio data is 
input. 

An electronic watermark embedding unit 42 generates 
data obtained by embedding the information WM in the first 
input digital data D -Audio. This information WM is ncces- 45 
sary for generating the encryption key used in recording the 
audio data on the a DVD 47 upon encrypting it. An MPEG- 
Audio encoder 43 compresses the data output from the unit 
42 and outputs the audio data WM(ADi). 
— ^" ^^^s c ase^ ^ k ^ y g&ncration unit 46 g enerates the 50 
6nQty,p.tlQn_ k6y^Dk+WM using the disk key Dk andjhe 
information WM necessary for g enerating the encryption 
key for recordin g data on the DVP 47. 

The key generation unit 46 has any arrangement in which 
the encryption key Dk+WM cannot be generated by any one 5S 
of the disk key Dk and the key information WM. 

The output audio data ADi output from the MPEG-Audio 
encoder 43 is encrypted using the disk key Dk by an 
encryption unit 44. The encrypted audio data E^^WM 
(ADi)) is recorded on the DVD 47. 60 

When all the information WM necessary for generating 
the encryption key Dk+WM for recording data on the DVD 
47 is embedded in the electronic watermark embedding unit 
42, a switch 41 is switched by a control signal CS. The 
subsequent digital data D-Audio are directly input to the 65 
MPEG-Audio encoder 43, and the corresponding com- 
pressed audio data ADi are output. 



The encryption unit 44 encrypts the input audio data ADi 
using the encryption key Dk+WM and outputs E^j^^^y^r 
(ADi). The encrypted output data E^^^^t^vvXADi) is recorded 
on the DVD 47. 

The DVD 47 also records {Ej^JDk)} obtained by 
encrypting the disk key Dk (used in encrypting the audio 
data ADi) using the bunch of master keys, and Dk(Dk) 
encrypting using the disk key itself. ) 

For the sake of descriptive simplicity, the audio data ADi 
compressed by the MPEG-Audio encoder is directly 
encrypted using the encryption key Dk+WM. The following 
improvement further protects the data. 
(Improvement) 

The key generation information WM is defined as infor- 
mation WMi changing as a function of the time scries, and 
all audio data are embedded as electronic watermark infor- 
mation. The encryption key for recording data on the DVD 
47 is changed as Dk+WM each time on the basis of the 
embedded information WM,-. Encrypted audio data E^j^^ 
wvf»-i(WM(ADi)) is recorded on the DVD 47. 
<Third Embodiment> 

FIG. 8 is a block diagram showing a copy protection 
apparatus according to the third embodiment of the present 
invention. The same reference numerals as in FIG. 1 denote 
the same parts in FIG. 8, and a detailed description thereof 
will be omitted. Only a portion associated with playback 
CPU is illustrated in FIG. 8. 

The copy protection apparatus of this embodiment com- 
prises a DVD drive unit (not shown) for reading data from 
a DVD 1, and encryption and decryption systems A and C 
connected to the DVD drive unit without being through a 
CPU bus or incorporated in the DVD drive unit. 

The encryption system A is connected to the decryption 
system C via a CPU bus B. Data from the decryption system 
C is output via, e.g., an I/O port except the CPU bus B. More 
specifically, in this embodiment, data is input/output without 
being through the CPU bus B, but data is transferred 
between the systems A and C using the CPU bus B. 

The encryption system A comprises demodulation/error 
correction units 2 and 7, and an encryption unit 4. The 
encryption system A is formed as one independent IC chip. 

The decryption system C comprises decryption units 5 
and 50, a master key decryption/determination unit 31, an 
electronic watermark extraction unit 51, a superposed infor- 
mation elimination unit 53, and a delay unit 52. The decryp- 
tion system C of this embodiment includes an MPEG- 
Decoder 14 and an D/A converter 15 for convening the 
decoded digital audio data into analog audio data. 

The two decryption units 5 and 50 are illustrated in the 
decryption system C, but only one unit can constitute these 
two units. The decryption system is formed as one indepen- 
dent IC chip. 

Some of master keys are registered (stored) in the decryp- 
tion system as in the second embodiment. TTie master keys 
are recorded in a secret area in the chip so as not to allow a 
user to externally obtain them or intentionally read out them 
from the chip of the decryption system. 

The number of types of keys £j^ff^J(pk) recorded on a 
DVD 1 and generated by encrypting the disk key using 
master keys Mki and the number of types of master keys 
Mki in the decryption system C can be set as in the first 
embodiment. 

The encryption and decryption keys (both are Bk because 
the common key encryption is used) used in cryptographic 
communication via the CPU bus B are shared by the 
encryption and decryption systems A and C. 

A controller (not shown) controls the overall operation. 
For example, the controller can be realized by causing the 
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CPU of the computer to execute a program. Examples of Upon extracting the information WM, WM(ADi) is 

control of this controller are designation associated with a directly supplied to the MPEG-Decoder 14. In this case, 

data read from the DVD, designation of data transfer various relationships can be set for a method of superposing 

destination, designation associated with data output from the the information WM on the audio data and the information 

decryption system, and the like. 5 WM superposed in recording the audio data on the DVD 1 

The controller is triggered by a user through a user as follows. Computation used in this superposition is rep- 

interface or by a process in a given application program. resented by *X' in the following description. 

In this embodiment, a digital source audio data sequence, (Relationship 1) 

an audio data sequence (compressed data sequence), and an The superposed information WM is adjusted to have the 

audio data in which any information is embedded as an same data length as that of the audio data ADi by some 

electronic watermark are represented by D-Audio, means, and the superposed information WM and the audio 

AD-{AD1, AD2, . . . , ADi, . . . }, and WM(ADi), data ADi are logically ORed, 

respectively. (Relationship 2) 

Depending on audio data sequences AD, copy control The audio data ADi is encrypted using the superposed 

electronic watermark information may be embedded in information WM as an encryption key. 

addition to the embedded electronic watermark information. In step S37, E^j^ADiXWM) which is generated by 

Let Bk, Dk, {Mkl, Mk2, . . . , Mki, . . , , Mkn}, and {Mkl', encrypting the audio data, superposed with the watermark 

Mk2', . . . , Mkj', . . . , Mkm'} be the encryption key (to be information WM, using the disk key Dk and which is 

referred to as a shared encryption key) shared between the recorded on the DVD 1 is read by a DVD drive unit (not 

encryption and decryption systems A and C, the encryption shown). The read data E^;fe(ADiXWM) is sent to the decryp- 

key (disk key) for encrypting the audio data sequence, the 20 lion system C via the CPU interface B. 

bunch of n encryption keys (master keys) for encrypting the The data read from the DVD 1 arc demodulated and 

disk key, and the bunch of part master keys registered in the error-corrected by the demodulatiori/error correction unit 7 

decryption system C, respectively. before they are sent to the CPU interface B. 

In FIG. 8, E^ij^Dk) represents a disk key generated by In step S38, the decryption unit 50 in the decryption 

encryption using the disk key itself. {EAflti<Dk)(i=0, 1, ... , is system C decrypts, using the audio data key Dk, E^;t 

n-1)} represents disk keys generated by encryption using (ADiXWM) received via the CPU bus B. The superposed 

the n master keys. WM(ADi) represents audio data ADi information elimination unit 53 extracts the superposed 

generated by embedding information necessary for gener- information WM to obtain the compressed audio data ADi 

a ting encrypted keys for subsequent audio data using an serving as the plaintext. 

electronic watermark technique. 30 In step S39, it is determined whether decryption contin- 

EDfc(WM(ADi)) represents WM(ADi) encrypted and gen- ues. If YES in step S39, operations in steps S37 and S38 are 

erated using the disk key Dk. ADiXWM represents the audio repeated. 

data ADi on which the information WM sent to the decryp- When the resultant audio data ADi is compressed by the 

tion system by the electronic watermark in advance is data compression standard called, e.g., MPEG-Audio, it is 

superposed. E^j^,(ADiXWM) represents (ADiXWM) 35 decoded (expanded) by the MPEG-Decoder 14. The 

encrypted and generated using the disk key Dk. ^sjffij^j^ decoded data is converted into an analog signal by the D/A 

(Dk)) represents E£>;t(Dk) encrypted and generated using the converter 15. The analog signal is sent to an audio 

shared encryption key Bk. EBjJiJB.j^(jy\^) represents Ej^^ amplification/output unit such as a loudspeaker amplifier 

(Dk) encrypted and generated using the shared encryption (not shown) and reproduced. 

key Bk. Note that 'X* indicates a superposition operation for 40 The superposed information to be embedded in the audio 

disturbing data. For example, it indicates an operation in data may be embedded in a plurality of audio data, as 

which data are subjected to an appropriate scramble, and needed. 

'ADiXWM' indicates that ADi is scrambled by using an The audio data ADi need not be transferred from the 

appropriate WM. decryption system C to the MPEG-Decoder 14 one by one, 

E^jjtCDk) generated by encrypting the disk key by itself 45 but may be transferred in units of a predetennincd number 

and {Ej^fjfy&)} generated by encrypting the disk key using of audio data. 

the bunch of master keys are recorded in a key recording According to the copy protection apparatus of this 

area (lead-in area) of the inner peripheral portion of the embodiment, electronic watermark information is embedded 

DVD 1. E^;t(WM(ADi)) generated by encrypting, using the in the multimedia data, and the multimedia data is decrypted 

disk key, the audio data in which information superposed oh 50 using the embedded electronic watermark information, 

the subsequent audio data in the audio data sequence thereby preventing unauthorized copying. 

AD- {ADI, AD2, . . . , ADi, . . . } is embedded as the According to the copy protection apparatus of this 

electronic watermark information WM, and E^,,^ ADiXWM) embodiment, encryption and decryption units can be 

obtained by encrypting, using the disk key, the audio data designed independently of the core of the reproduction 

superposed with the electronic watermark information WM, 55 portion of the digital recording/reproduction equipment, 

are recorded in a data recording area (data area). such as the DVD 1, as can be apparent from FIG. 8. Even 

The operation of this embodiment will be described with if a cryptographic algorithm and electronic watermark are 

reference to the flow chart in FIG. 9. broken, only the decryption system C (or both the encryption 

Steps S31 to S35 are identical to steps S21 to S25 of the and decryption systems A and C) is replaced with another 

flow chart shown in FIG, 6 and described in the second 60 one. 

embodiment. In any of the above embodiments, the CPU bus commu- 

In step S36, the decryption unit 50 in the decryption nication unit using the shared encryption key can be omitted 

system C decrypts, using the disk key Dk, the data E^;t(WM to obtain an embodiment suitable for a stand-alone DVD 

(ADi)) received via the CPU interface B to extract player. 

WM(ADi). The electronic watermark extraction unit 51 6S Finally, a method of recording the audio data and key 

extracts the information WM embedded in the data ADi and information on a DVD 1 according to this embodiment will 

superposed on the subsequent audio data. be described with reference to FIG. 10. 
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In this system, when input audio data is analog data 
A- Audio, it is converted into digital audio data D -Audio by 
an an alog-to -digital converter, and the digital audio data is 
input. 

An electronic watermark embedding unit 64 embeds the 
information WM, superposed on the subsequent audio data 
as the electronic watermark, in the first input digital data 
D-Audio. The resultant data is compressed by an MPEG- 
Audio encoder 63, thereby outputting audio information 
WD(ADi) in which the electronic watermark is embedded. 

Using the disk key Dk, an encryption unit 62 generates 
audio data E^^^^WMCADi)) obtained by encrypting the audio 
information WM(ADi) in which the electronic watermark is 
embedded. The encrypted audio data WM(ADi) is recorded 
on a DVD 61. 

When the electronic watermark embedding unit 64 
embeds all the information WM superposed on the audio 
data, a switch 65 is switched by a control signal CS. The 
subsequent digital data D-Audio is compressed by an 
MPEG-Audio encoder 66, and an electronic watermark 
information superpose unit 67 superposes (expressed by a 
symbol 'X') the electronic watermark information WM on 
the compressed subsequent digital data D-Audio. Super- 
posed audio data ADiXWM is output. 

The superposed audio data ADiXWM is encrypted using 
the disk key Dk by the encryption unit 62 in the same 
manner as the audio inforaaation WM(ADi) in which the 
electronic watermark is embedded. The data ADiXWM is 
recorded on the DVD 61 as the encrypted audio data 
Ej5;t(ADiXWM). 

The DVD 61 records {E^vfitXDk)} obtained by encrypting 
the disk key Dk using the bunch of master keys used in 
encrypting the audio data ADi and the superposed audio data 
ADiXWM, and Dk(Dk) obtained by encrypting the disk key 
by itself. 

For the descriptive simplicity, the same information WM 
is superposed on all the audio data compressed by the 
MPEG-Audio encoder. However, the following improve- 
ment further protects the data. 
(Improved Method 1) 

The key generation information WM is defined as the 
information WMi changing as a function of the time series, 
information necessary for reproduction is embedded in all 
the audio data as the electronic watermark information, and 
the embedded information WMi serves as information for 
scrambling the next audio data. That is, the superposed audio 
data ADiXWM described above is recorded on the DVD 1 
in the state of E^;t(WMi(ADi)XWMi-l). 
(Improved Method 2) 

The key generation information WM is defined as the 
information WMi changing as a function of the time series, 
information necessary for reproduction is embedded in all 
the audio data as the electronic watermark information, and 
the embedded information WMi serves as information for 
scrambling the audio data itself. Therefore, ADi is 
scrambled by WMi and then WMi is embedded in the 
scrambled ADiXWMi. That is, the superposed audio data 
ADiXWM described above is recorded on DVD 1 in the 
state of E^^Mi(ADi)XWMi). 
(Improved Method 3) 

The improved method 1 and 2 are generally described. 
Information necessary for reproduction is embedded in the 
audio data at a time as the electronic watermark information, 
and the embedded information WMi serves as information 
for scrambling data at an arbitrary time. Tberefore, ADi is 
scrambled by WMj and then the WMj is embedded in the 
audio data ADj at arbitrary time as the electronic watermark 
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information. That is, the superposed audio data ADiXWMj 
described above is recorded on the DVD 1 in the state of 
Eo;t(WMi(ADi)XWMj). 

The first, second, and third embodiments have been 
5 described independently of each other. However, various 
changes and modifications can be made. For example, the 
above three embodiments can be synthesized as one embodi- 
ment. 

In each embodiment described above, an information 
recording medium is a DVD. However, the present invention 
is also applicable to other recording media such as 
CD-ROM. 

Each embodiment described above, has exemplified audio 
data as information to be decoded. However, the present 
invention is also applicable to reproducing apparatuses in 

1^ other forms such as image data. 

Each embodiment described above has exemplified a case 
in which information to be decoded is compressed comply- 
ing with the standard called MPEG- Audio. The present 
invention is not limited to this. Information to be decoded 

20 may be compressed or encoded by another standard. In this 
case, a corresponding decoder is arranged in place of the 
MPEG-Audio decoder. Information to be decoded may be 
encoded or the like. In this case, the MPEG-Audio decoder 
is omitted. 

25 A plurality of types of decoders may be arranged so as to 
output any one of data compressed by a variety of schemes. 
These decoders may be appropriately switched (or these 
may not be used). For example, an identifier representing a 
decoder to be used is read firom a recording medium such as 
a DVD, and an appropriate decoder is selected in accordance 
with this identifier. 

The arrangement of the decryption/determination unit 
shown in the first embodiment is a merely example, and any 
other arrangement may be used. 

According to the present invention, part of information 
necessary for correctly decrypting or reproducing the 
recorded data is embedded in data recorded on the recording 
medium such as a DVD in accordance with the electronic 
watermark technique. Only authentic persons who can cor- 
rectly decode (decrypt) the data sent by dif[erent means can 
40 perfectly decode (decrypt) the data. 

As a result, unauthorized business operation of seUing 
copied media can be prevented, thereby protecting copyright 
infringement. 

Additional advantages and modifications will readily 
45 occur to those skilled in the art. Therefore, the invention in 
its broader aspects is not limited to the specific details and 
representative embodiments shown and described herein. 
Accordingly, various modifications may be made without 
departing from the spirit or scope of the general inventive 
5Q concept as defined by the appended claims and their equiva- 
lents. 

What is claimed is: 

1. A copy protection apparatus comprising: 
an encryption system; and 
55 a decryption system connected to said encryption system 
via a CPU bus, 
wherein said encryption system comprises 

first encryption means for encrypting, using a shared 
encryption key shared by said encryption system and 
60 said decryption system, an encrypted disk key 

encrypted using a disk key itself, 
first transmission means for transmitting, via the CPU 
bus, the disk key encrypted by said first encryption 
means, 

65 second encryption means for encrypting, using the 
shared encryption key, the encrypted disk key 
encrypted using the master key. 
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second transmission means for transmitting, via the 
CPU bus, the disk key encrypted by said second 
encryption means, 
third encryption means for encrypting, using the shared 
encryption key, multimedia data in which electronic s 
watermark information serving as some of the master 
keys is embedded, 
third transmission means for transmitting, via the CPU 
bus, the multimedia data encrypted by said third 
encryption means, and lo 
fourth transmission means for transmitting the multi- 
media data encrypted using the disk key, and 
said decryption system comprises 

first decryption means for decrypting, using the 
shared encryption key, the disk key transmitted 15 
from said first transmission means, 
second decryption means for decrypting, using the 
shared encryption key, the disk key transmitted 
from said second transmission means, 
third decryption means for decrypting, using the 20 
shared encryption key, the multimedia data trans- 
mitted from said third transmission means, 
extraction means for extracting the watermark infor- 
mation from the multimedia data decrypted by 
said third decryption means, 25 
disk key acquisition means for acquiring the disk key 
on the basis of the disk key decrypted by said first 
decryption means, the disk key decrypted by said 
second decryption means, the watermark informa- 
tion extracted by said extraction means, and a part 30 
master key corresponding to some of the master 
keys, and 

fourth decryption means for decrypting, using the 
disk key acquired by said disk key acquisition 
means, the multimedia data transmitted from said 35 
fourth transmission means. 

2. A copy protection apparatus according to claim 1, 
wherein said disk key acquisition means comprises: 

first acquisition means for acquiring a master key candi- 
date on the basis of the part master key and the 
watermark information; 

second acquisition means for acquiring, using the master 
key candidate acquired by said first acquisition means, 
a first disk key candidate by decrypting the disk key 
decrypted by said second decryption means; 

third acquisition means for acquiring, using the first disk 
key candidate acquired by said second acquisition 
means, a second disk key candidate by decrypting the 
disk key decrypted by said first decryption means; 

determination means for determining whether the first 
disk key candidate acquired by said second acquisition 
means coincides with the second disk key candidate 
acquired by said third acquisition means; and 

decision means for deciding the first disk key candidate as 55 
the disk key when said determination means determines 
that the first disk key candidate coincides with the 
second disk key candidate. 

3. An apparatus according to claim 1, wherein the mul- 
timedia data is audio data compressed in accordance with go 
MPEG standards. 

4. An apparatus according to claim 1, further comprising 
decoding means for decoding the multimedia data, 
decrypted by said fourth decryption means, in accordance 
with MPEG rules. 65 

5. A copy protection apparatus comprising: 
an encryption system; and 
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a decryption system connected to said encryption system 

via a CPU bus, 
wherein said encryption system comprises 

first encryption means for encrypting, using a shared 

encryption key shared by said encryption system and 

said decryption system, an encrypted disk key 

encrypted using a disk key itself, 
first transmission means for transmitting, via the CPU 

bus, the disk key encrypted by said first encryption 

means, 

second encryption means for encrypting, using the 
shared encryption key, the encrypted disk key 
encrypted using the master key, 
second transmission means for transmitting, via the 
CPU bus, the disk key encrypted by said second 
encryption means, 
third transmission means for transmitting, via the CPU 
bus, the multimedia data which is decrypted by the 
disk key and in which electronic watermark infor- 
mation serving as some of the master keys is 
embedded, and 
fourth transmission means for transmitting the multi- 
media data encrypted using the disk key and the 
watermark information, and 
said decryption system comprises 

first decryption means for decrypting, using the 
shared encryption key, the disk key transmitted 
from said first transmission means, 
second decryption means for decrypting, using the 
shared encryption key, the disk key transmitted 
from said second transmission means, 
disk key acquisition means for acquiring the disk key 
on the basis of the disk key decrypted by said first 
decryption means, the disk key decrypted by said 
second decryption means, the watermark informa- 
tion extracted by said extraction means, and a part 
master key corresponding to some of the master 
keys, 

third decryption means for decrypting, using the disk 
key acquired by said disk key acquisition means, 
the multimedia data transmitted from said third 
transmission means, 

extraction means for extracting the electronic water- 
mark information from the multimedia data 
decrypted by said third decryption means, and 

fourth decryption means for decrypting the multime- 
dia data from said fourth transmission means on 
the basis of the electronic watermark information 
extracted by said extraction means and the disk 
key acquired by said disk key acquisition means. 

6. An apparatus according to claim 5, wherein the mul- 
timedia data is audio data compressed in accordance with 
MPEG standards. 

7. An apparatus according to claim 5, further comprising 
decoding means for decoding the multimedia data, 
decrypted by said fourth decryption means, in accordance 
with MPEG rules. 

8. A copy protection apparatus comprising: 
an encryption system; and 

a decryption system connected to said encryption system 

via a CPU bus. 
wherein said encryption system comprises 

first encryption means for encrypting, using a shared 
encryption key shared by said encryption system and 
said decryption system, an encrypted disk key 
encrypted using a disk key itself, 
first transmission means for transmitting, via the CPU 
bus, the disk key encrypted by said first encryption 
means, 
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second encryption means for encrypting, using the 
shared encryption key, the encrypted disk key 
encrypted using the master key, 
second transmission means for transmitting, via the 
CPU bus, the disk key encrypted by said second ^ 
encryption means, 
third transmission means for transmitting, via the CPU 
bus, the multimedia data which is decrypted by the 
disk key and in which electronic watermark infor- 
mation serving as some of the master keys is 
embedded, and lo 
fourth transmission means for transmitting, via the 
CPU bus, the multimedia data which is encrypted by 
the disk key and on which the electronic watermark 
information is superposed, and 
said decryption system comprises 
first decryption means for decrypting, using the 
shared encryption key, the disk key transmitted 
from said first transmission means, 
second decryption means for decrypting, using the 
shared encryption key, the disk key transmitted 
from said second transmission means, 
disk key acquisition means for acquiring the disk key 
on the basis of the disk key decrypted by said first 
decryption means, the disk key decrypted by said 
second decryption means, the watermark informa- 
tion extracted by said extraaion means, and a part 25 
master key corresponding to some of the master 
keys, 
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third decryption means for decrypting, using the disk 
key acquired by said disk key acquisition means, 
the midtimedia data transmitted from said third 
transmission means, 
extraction means for extracting the electronic water- 
mark information from the multimedia data 
decrypted by said third decryption means, 
fourth decryption means for decrypting, using the 
disk key acquired by said disk key acquisition 
means, the multimedia data transmitted from said 
fourth transmission means, and 
fifth decryption means for decrypting, using the 
electronic watermark information extracted by 
said extraction means, the multimedia data 
decrypted by said fourth decryption means. 

9. An apparatus according to claim 8, wherein the mul- 
timedia data is audio data compressed in accordance with 
MPEG standards. 

10. An apparatus according to claim 8, further comprising 
decoding means for decoding the multimedia data, 
decrypted by said fourth decryption means, in accordance 
with MPEG rules. 

* ♦ * ♦ * 
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